Anti-Malware Exclusions don't appear to work

[StevePearson]

I'm investigating issues with Anti-Malware exclusions not working. Endpoint is deployed from the Infinity portal, I've seen the issue on multiple tenants and multiple client builds including E86.50 .60 .70 and .80, and I've seen it with both the DHS compliant and non compliant versions.

It's a simple requirement, I have a folder that I want to exclude from Anti-Malware scanning, and my definition of "exclude" is don't touch it at all, so consider the following example:

C:\MyFiles contains 2 folders called Folder1 and Folder2. I copy 10 files into each folder, then right click on C:\MyFiles in explorer and select Scan with Checkpoint Anti-Malware. The Client window appears to show the scan, and reports 20 files scanned, as you'd expect.

Now I go to the portal and add an exclusion. I've tried this as a global exclusion and as an exclusion of a specific policy, the result is the same. I expand the Anti-Malware -> File & Folder Exclusions section and add a new exclusion for the path C:\MyFiles\Folder2 save the changes and deploy the policy. I check the client policy version, update the client and check the policy version again to ensure it's updated. Then I right click on C:\MyFiles in explorer and select Scan with Checkpoint Anti-Malware again. I would now expect the scan window to report 10 files scanned as the other 10 are in the excluded folder, but no it still reports 20 files scanned.

I've double checked my exclusion syntax against SK122706, and it is correct.

I don't believe i'm doing anything wrong, so is it's definition of exclude different to mine in some way, and if so how do I change this to completely exclude and not touch the folders/files that I need to?

This is a small example that's easy to reproduce and test, the real issue is much much bigger! It involves OneDrive and Dropbox folders that have thousands of files that absolutely don't need to be touched at all. (They are protected by Harmony Email and Colaboration!)

I can't be the only person that's encountered this, so i'm hoping someone and point me in the right direction please!

[Chris_Atkinson]

How the scan is being triggered is the primary factor here, these "folder" exclusions are being ignored when the scan is triggered in the manner described but are enforced otherwise e.g. scheduled/periodic & on-access scans etc. 

Currently this is how it works but I can see how for diagnostic reasons it might be helpful. Suggest discussing it further with your local SE as a possible enhancement if this is important for you.

[StevePearson]

In my tests it's triggered manually, but in the live environment it's a scheduled scan.

[Chris_Atkinson]

If you believe that it's not working for scheduled scans please consult TAC for how to debug it further.

[StevePearson]

Would you class a scan pushed from the portal in the same way as the test scan I've been doing?

So basically ANY scan that is manually initiated will ignore exclusions but any other scan should follow them?

[Chris_Atkinson]

TAC should be able to confirm, but from the SK for folder exclusions we have.

Settings affect:

On Windows client:

File On access monitor

Behavioral monitor (detects unusual activity)

Web monitor (Web protection)

Scheduled scan

System scan (scan system now)

[the_rock]

Can you send a screenshot of the exclusion you did? I have access to 2 customers portals who do this often and I can definitely verify the logic there and tell you if its right. Im way more fw than endpoint guy, but I know my way around it : - )

[StevePearson]

I've attached a couple of examples.

[the_rock]

I believe your syntax is wrong. Have a look at examples they have in the portal:

Andy 

[Chris_Atkinson]

Per sk122706:

[the_rock]

Correct Chris, but I dont believe syntax from the screenshot is option in the sk or from the portal I attached.

[StevePearson]

So you're saying that if I use an environment variable then I should drop the drive letter?

This doesn't explain the second example on my screenshot, and also what if the path exists on multiple drives but you only want to exclude on C drive? (a backup copy of the user profile on the E drive for example)

[the_rock]

Thats exactly what Im saying, but I could be mistaken. Though, my logic is purely based on screenshot from portal I sent you and also examples given from the sk. But, I do get your point about C drive if thats ONLY drive you wish to exclude. Sorry mate, you may want to confirm this with TAC.